[Session.Auth] introduce secure flag